Stream Auth0 Events

Follow this step by step guide to enable real-time event streaming from your Auth0 Tenant to SlashID for enhanced monitoring and protection.

Step 1: Create a Log Stream

1. Log in to the Auth0 Dashboard.

2. Navigate to 'Monitoring' > 'Streams' from the left sidebar.

3. Click on the '+ Create Log Stream' button.

Configure the Log Stream

4. In the 'Create Log Stream' window:
   1. Select 'Custom Webhook' as the event destination type.
   2. Enter a name for your log stream (e.g., "SlashID Event Stream").
   3. Enter https://api.slashid.com/nhi/events/v2/auth0_domain in the 'Payload URL' field.
   4. Set 'Content Type' to application/json.
   5. Set 'Content Format' to JSONLINES.
   6. In the 'Authorization Token' field, enter your SlashID Data Source Event Streaming Token.
   7. Select the event types you want to stream. For comprehensive monitoring, we recommend selecting all event types.
   8. Click on the 'Save' button.

tip

You can obtain your SlashID Data Source Event Streaming Token from the SlashID Console at 'Identity Protection' > 'Configuration' > 'Data sources'. Click on your Auth0 data source and copy the 'Event Streaming Token'.

---

Verify Configuration

• Once saved, Auth0 will begin streaming events to SlashID in real-time.
• You can verify the stream is working by checking the 'Health' indicator in the Streams list - it should show 'Active' status.
• Events will appear in the Identity Protection Dashboard within a few moments.

---

Event Types

Auth0 streams various event types including:

• Authentication Events: Successful and failed logins, logouts
• User Management: User creation, updates, deletions, password changes
• MFA Events: Multi-factor authentication enrollment and challenges
• Token Events: Token exchanges, refreshes, and revocations
• API Operations: Management API calls and operations
• Administrative Actions: Settings changes and admin operations

For a complete list of Auth0 event types, see the Auth0 Log Event Type Codes documentation.